System and method for computer data type identification

ABSTRACT

A system and method for file type identification involving extraction of a file-print of a file, the file-print being a unique or practically-unique representation of statistical characteristics associated with the distribution of bits in the binary contents of the file, similar to a fingerprint. The file-print is then passed to a machine learning algorithm that has been trained to recognize file types from their file-prints. The machine learning algorithm returns a predicted file type and, in some cases, a probability of correctness of the prediction. The file may then be encoded using an encoding algorithm chosen based on the predicted file type.

CROSS-REFERENCE TO RELATED APPLICATIONS

Priority is claimed in the application data sheet to the followingpatents or patent applications, the entire written description of eachof which is expressly incorporated herein by reference in its entirety:

-   -   Ser. No. 17/727,919    -   Ser. No. 17/501,872    -   Ser. No. 16/923,039    -   63/027,166    -   Ser. No. 16/716,098    -   Ser. No. 16/455,655    -   Ser. No. 16/200,466    -   Ser. No. 15/975,741    -   62/578,824    -   62/926,723    -   63/232,030

BACKGROUND OF THE INVENTION Field of the Invention

The present invention is in the field of computer data identificationand in particular the usage of machine-learning technology to providedata type identification.

Discussion of the State of the Art

As computers become an ever-greater part of our lives, and especially inthe past few years, data storage has become a limiting factor worldwide.Prior to about 2010, the growth of data storage far exceeded the growthin storage demand. In fact, it was commonly considered at that time thatstorage was not an issue, and perhaps never would be, again. In 2010,however, with the growth of social media, cloud data centers, high techand biotech industries, global digital data storage acceleratedexponentially, and demand hit the zettabyte (1 trillion gigabytes)level. Current estimates are that data storage demand will reach 50zettabytes by 2020. By contrast, digital storage device manufacturersproduced roughly 1 zettabyte of physical storage capacity globally in2016. We are producing data at a much faster rate than we are producingthe capacity to store it. In short, we are running out of room to storedata, and need a breakthrough in data storage technology to keep up withdemand.

The primary solutions available at the moment are the addition ofadditional physical storage capacity and data compression. As notedabove, the addition of physical storage will not solve the problem, asstorage demand has already outstripped global manufacturing capacity.Data compression is also not a solution. A rough average compressionratio for mixed data types is 2:1, representing a doubling of storagecapacity. However, as the mix of global data storage trends towardmulti-media data (audio, video, and images), the space savings yieldedby compression either decreases substantially, as is the case withlossless compression which allows for retention of all original data inthe set, or results in degradation of data, as is the case with lossycompression which selectively discards data in order to increasecompression. Even assuming a doubling of storage capacity, datacompression cannot solve the global data storage problem. The methoddisclosed herein, on the other hand, works the same way with any type ofdata.

Transmission bandwidth is also increasingly becoming a bottleneck. Largedata sets require tremendous bandwidth, and we are transmitting more andmore data every year between large data centers. On the small end of thescale, we are adding billions of low bandwidth devices to the globalnetwork, and data transmission limitations impose constraints on thedevelopment of networked computing applications, such as the “Internetof Things.”

Furthermore, as quantum computing becomes more and more imminent, thesecurity of data, both stored data and data streaming from one point toanother via networks, becomes a critical concern as existing encryptiontechnologies are placed at risk.

A difficulty with encoding files for storage or transmission is that thetype of file may need to be identified before encoding. Identificationof the file type for certain types of encoding is useful because thefile type may influence how the file is encoded. Checking the filesignature is one method of determining a file type, but may beunreliable or unavailable if the file has been modified or corrupted, orwhere more than one file type is associated with a given signature. Amethod is needed for obtaining a file type which is not restricted tothe identification of a file signature and will be described herein.

What is needed is a fundamentally new approach to file typeidentification that does not rely solely on file signature information.

SUMMARY OF THE INVENTION

The inventor has developed a system and method for file typeidentification which does not rely solely on identification by a filesignature. The system and method involve a comparison of statisticalsimilarities between the binary distributions of files of a given type.When a file is received with a missing or unreadable file signature, astatistical analysis of the file is performed to extract a “file-print”of the file, the file-print being a unique or practically-uniquerepresentation of statistical characteristics associated with thedistribution of bits in the binary contents of the file, similar to afingerprint. The file-print is then passed to a machine learningalgorithm that has been trained to recognize file types from theirfile-prints. The machine learning algorithm returns a predicted filetype and, in some cases, a probability of correctness of the prediction.The file may then be encoded using an encoding algorithm chosen based onthe predicted file type.

According to a preferred embodiment, a system for identifying a filetype is disclosed, comprising: a computing device which comprises aprocessor, a memory, and a first plurality of instructions of which iscomprised of a machine-learning training algorithm, which is stored inthe memory and operable on the processor; when operating on theprocessor this causes the processor to: retrieve information from adatabase containing non-volatile memory of which has data pertaining toat least a plurality of file types; the next instructions causes theprocessor to parse the binary contents for data which is an unknown filetype; process the binary distribution-based values of this data usingstatistical analysis; store this analysis result in an array which is ofa size divisible by two; send this array to a database which containstraining data stored on non-volatile memory; connect this database witha machine-learning algorithm in order to train it for making comparisonswith results for known file types to this data which is of an unknownfile type. A second plurality of instructions, which is comprised of amachine-learning algorithm, which is stored in the memory and operableon the processor; when operating on the processor this causes theprocessor to: retrieve a file of which has an unknown file type;retrieve information containing binary distribution analysis data forknown file types stored in a database which contains non-volatilememory; retrieve information containing file signature data of knownfile types stored in a database which contains non-volatile memory; thenext instructions of which causes the processor to: process the binarydistribution-based values of the file which is of an unknown file type,store the resulting analysis in an array which is of a size divisible bytwo; compare the results from this analysis to pre-existing datacontained in the retrieved database information which contains binarydistribution analysis results of known file types; the final instructionof which causes the processor to generate a predictive file type for thefile.

According to a preferred embodiment, a method for identifying a filetype is disclosed, comprising: a computing device which comprises of aprocessor, a memory, and a first plurality of instructions of which iscomprised of a machine-learning training algorithm, which is stored inthe memory and operable on the processor; when operating on theprocessor this causes the processor to: retrieve information from adatabase containing non-volatile memory of which has data pertaining toat least a plurality of file types; the next instructions causes theprocessor to parse the binary contents for data which is an unknown filetype; process the binary distribution-based values of this data usingstatistical analysis; store this analysis result in an array which is ofa size divisible by two; send this array to a database which containstraining data stored on non-volatile memory; connect this database witha machine-learning algorithm in order to train it for making comparisonswith results for known file types to this data which is of an unknownfile type. A second plurality of instructions, which is comprised of amachine-learning algorithm, which is stored in the memory and operableon the processor; when operating on the processor this causes theprocessor to: retrieve a file of which has an unknown file type;retrieve information containing binary distribution analysis data forknown file types stored in a database which contains non-volatilememory; retrieve information containing file signature data of knownfile types stored in a database which contains non-volatile memory; thenext instructions of which causes the processor to: process the binarydistribution-based values of the file which is of an unknown file type,store the resulting analysis in an array which is of a size divisible bytwo; compare the results from this analysis to pre-existing datacontained in the retrieved database information which contains binarydistribution analysis results of known file types; the final instructionof which causes the processor to generate a predictive file type for thefile.

BRIEF DESCRIPTION OF THE DRAWING FIGURES

The accompanying drawings illustrate several aspects and, together withthe description, serve to explain the principles of the inventionaccording to the aspects. It will be appreciated by one skilled in theart that the particular arrangements illustrated in the drawings aremerely exemplary, and are not to be considered as limiting of the scopeof the invention or the claims herein in any way.

FIG. 1 is a diagram showing an embodiment of the system in which allcomponents of the system are operated locally.

FIG. 2 is a diagram showing an embodiment of one aspect of the system,the data deconstruction engine.

FIG. 3 is a diagram showing an embodiment of one aspect of the system,the data reconstruction engine.

FIG. 4 is a diagram showing an embodiment of one aspect of the system,the library management module.

FIG. 5 is a diagram showing another embodiment of the system in whichdata is transferred between remote locations.

FIG. 6 is a diagram showing an embodiment in which a standardizedversion of the sourceblock library and associated algorithms would beencoded as firmware on a dedicated processing chip included as part ofthe hardware of a plurality of devices.

FIG. 7 is a diagram showing an example of how data might be convertedinto reference codes using an aspect of an embodiment.

FIG. 8 is a method diagram showing the steps involved in using anembodiment to store data.

FIG. 9 is a method diagram showing the steps involved in using anembodiment to retrieve data.

FIG. 10 is a method diagram showing the steps involved in using anembodiment to encode data.

FIG. 11 is a method diagram showing the steps involved in using anembodiment to decode data.

FIG. 12 is a diagram showing an exemplary system architecture, accordingto a preferred embodiment of the invention.

FIG. 13 is a diagram showing a more detailed architecture for acustomized library generator.

FIG. 14 is a diagram showing a more detailed architecture for a libraryoptimizer.

FIG. 15 is a diagram showing a more detailed architecture for atransmission and storage engine.

FIG. 16 is a method diagram illustrating key system functionalityutilizing an encoder and decoder pair.

FIG. 17 is a method diagram illustrating possible use of a hybridencoder/decoder to improve the compression ratio.

FIG. 18 is a flow diagram illustrating the use of a data encoding systemused to recursively encode data to further reduce data size.

FIG. 19 is an exemplary system architecture of a data encoding systemused for cyber security purposes.

FIG. 20 is a flow diagram of an exemplary method used to detectanomalies in received encoded data and producing a warning.

FIG. 21 is a flow diagram of a data encoding system used for DistributedDenial of Service (DDoS) attack denial.

FIG. 22 is an exemplary system architecture of a data encoding systemused for data mining and analysis purposes.

FIG. 23 is a flow diagram of an exemplary method used to enablehigh-speed data mining of repetitive data.

FIG. 24 is an exemplary system architecture of a data encoding systemused for remote software and firmware updates.

FIG. 25 is a flow diagram of an exemplary method used to encode andtransfer software and firmware updates to a device for installation, forthe purposes of reduced bandwidth consumption.

FIG. 26 is an exemplary system architecture of a data encoding systemused for large-scale software installation such as operating systems.

FIG. 27 is a flow diagram of an exemplary method used to encode newsoftware and operating system installations for reduced bandwidthrequired for transference.

FIG. 28 is an exemplary system architecture diagram for a fileclassification system used for determining a file type.

FIG. 29 is a flow diagram illustrating an exemplary process fordetermining whether a file should be passed as input to amachine-learning based classification algorithm.

FIG. 30 is flowchart describing an exemplary file-print extractionprocess.

FIG. 31 is an exemplary process for file type identification using afile classifier.

FIG. 32 is a flow diagram which illustrates an exemplary operation of afile signature extractor.

FIG. 33 is a block diagram illustrating an exemplary hardwarearchitecture of a computing device.

FIG. 34 is a block diagram illustrating an exemplary logicalarchitecture for a client device.

FIG. 35 is a block diagram showing an exemplary architecturalarrangement of clients, servers, and external services.

FIG. 36 is another block diagram illustrating an exemplary hardwarearchitecture of a computing device.

DETAILED DESCRIPTION

The inventor has conceived, and reduced to practice, various a systemand method for file type identification which does not rely solely onidentification by a file signature. The system and method involve acomparison of statistical similarities between the binary distributionsof files of a given type. When a file is received with a missing orunreadable file signature, a statistical analysis of the file isperformed to extract a “file-print” of the file, the file-print being aunique or practically-unique representation of statisticalcharacteristics associated with the distribution of bits in the binarycontents of the file, similar to a fingerprint. The file-print is thenpassed to a machine learning algorithm that has been trained torecognize file types from their file-prints. The machine learningalgorithm returns a predicted file type and, in some cases, aprobability of correctness of the prediction. The file may then beencoded using an encoding algorithm chosen based on the predicted filetype.

A difficulty with encoding files for storage or transmission is that thetype of file may need to be identified before encoding. Identificationof the file type for certain types of encoding is useful because thefile type may influence how the file is encoded. One primary method ofdetermining a file type is checking of the file signature information(bytes contained in the beginning of a file) for the file. However, thismethod may be unreliable or unavailable if the file has been modified(i.e., the file signature is no longer contained in the initial bytes orthe file signature has been corrupted) or where the file signatureinformation is that of a general text-based file type such as .ascii(there may be more than one file type classified as an .ascii based onthe file signature information).

Files with unidentified file types exist in many forms, including butnot limited to ASCII files, corrupted files (such as those created withincomplete data transfers or where there has been user tampering), andfiles that do include an identifier for its file type—known as its “filesignature.” Despite the lack of a usable file signature, the binarydistributions of files of a given type are expected to statisticallysimilar. This expected consistency can be utilized to predict a filetype for a file which is of an unidentified file type.

When a file is received with a missing or unreadable file signature, astatistical analysis of the file is performed to extract a “file-print”of the file, the file-print being a unique or practically-uniquerepresentation of statistical characteristics associated with thedistribution of bits in the binary contents of the file, similar to afingerprint. The file-print is then passed to a machine learningalgorithm that has been trained to recognize file types from theirfile-prints. To use a machine learning algorithm to predict file types,the machine learning algorithm is first trained by passing file-printsfor known types through the algorithm, and allowing the machine learningalgorithm to identify patterns within the file-prints that are similaror dissimilar to patterns of file-prints for other known file types.After a sufficient amount of training, machine learning algorithms areable to reliably classify files of unknown type based on theirfile-prints without requiring file signatures.

A unique property of this method of classifying files based onfile-prints is that it can be applied not only to unencoded files, butalso to encoded files whose contents cannot be read. When applied to anencoded file, the file-print will be different from the file-print ofthe unencoded file, but will contain statistical similarities with filesof similar types encoded by the same encoding process. Thus, a machinelearning algorithm can be trained on file-prints for files of knowntypes and known encoding processes, and will learn to identify the filetype and encoding process for file-prints of unknown files, thusallowing for selection of the correct decoding process for the file.

In an embodiment, file-prints are generated by parsing each file intobytes (8 bits), analyzing the statistical distribution of bytes in theparsed file, and generating a 512 bit array, wherein the first 256 bitsrepresent a mean value for the distribution of bytes in the file and thesecond 256 bits represent a variance from the mean value for thedistribution of bytes in the file. However, many different file-printscan be generated, depending on the parsing of the file (bits, bytes,words, etc., or combinations thereof), and the statisticalcharacteristics assessed (e.g., mean, median, variance, skewness, etc.).For example, another method of generating a file-print is to parse filesinto groups of two bytes (16 bits) and determining the mean and varianceof every two bytes. The method chosen may depend on several factorsincluding, but not limited to, file sizes, processing power available,desired processing time per file, desired uniqueness of the file-print,etc. However, file type recognition will generally be enhanced whencomparing file-prints generated by the same method.

While the examples herein are discussed in terms of files, themethodology herein applies to data in any format (e.g., streaming datareceived prior to storage in a file) and in any storage location (e.g.,data stored in random access memory, and not on a non-volatile datastorage device as a file).

One or more different aspects may be described in the presentapplication. Further, for one or more of the aspects described herein,numerous alternative arrangements may be described; it should beappreciated that these are presented for illustrative purposes only andare not limiting of the aspects contained herein or the claims presentedherein in any way. One or more of the arrangements may be widelyapplicable to numerous aspects, as may be readily apparent from thedisclosure. In general, arrangements are described in sufficient detailto enable those skilled in the art to practice one or more of theaspects, and it should be appreciated that other arrangements may beutilized and that structural, logical, software, electrical and otherchanges may be made without departing from the scope of the particularaspects. Particular features of one or more of the aspects describedherein may be described with reference to one or more particular aspectsor figures that form a part of the present disclosure, and in which areshown, by way of illustration, specific arrangements of one or more ofthe aspects. It should be appreciated, however, that such features arenot limited to usage in the one or more particular aspects or figureswith reference to which they are described. The present disclosure isneither a literal description of all arrangements of one or more of theaspects nor a listing of features of one or more of the aspects thatmust be present in all arrangements.

Headings of sections provided in this patent application and the titleof this patent application are for convenience only, and are not to betaken as limiting the disclosure in any way.

Devices that are in communication with each other need not be incontinuous communication with each other, unless expressly specifiedotherwise. In addition, devices that are in communication with eachother may communicate directly or indirectly through one or morecommunication means or intermediaries, logical or physical.

A description of an aspect with several components in communication witheach other does not imply that all such components are required. To thecontrary, a variety of optional components may be described toillustrate a wide variety of possible aspects and in order to more fullyillustrate one or more aspects. Similarly, although process steps,method steps, algorithms or the like may be described in a sequentialorder, such processes, methods and algorithms may generally beconfigured to work in alternate orders, unless specifically stated tothe contrary. In other words, any sequence or order of steps that may bedescribed in this patent application does not, in and of itself,indicate a requirement that the steps be performed in that order. Thesteps of described processes may be performed in any order practical.Further, some steps may be performed simultaneously despite beingdescribed or implied as occurring non-simultaneously (e.g., because onestep is described after the other step). Moreover, the illustration of aprocess by its depiction in a drawing does not imply that theillustrated process is exclusive of other variations and modificationsthereto, does not imply that the illustrated process or any of its stepsare necessary to one or more of the aspects, and does not imply that theillustrated process is preferred. Also, steps are generally describedonce per aspect, but this does not mean they must occur once, or thatthey may only occur once each time a process, method, or algorithm iscarried out or executed. Some steps may be omitted in some aspects orsome occurrences, or some steps may be executed more than once in agiven aspect or occurrence.

When a single device or article is described herein, it will be readilyapparent that more than one device or article may be used in place of asingle device or article. Similarly, where more than one device orarticle is described herein, it will be readily apparent that a singledevice or article may be used in place of the more than one device orarticle.

The functionality or the features of a device may be alternativelyembodied by one or more other devices that are not explicitly describedas having such functionality or features. Thus, other aspects need notinclude the device itself.

Techniques and mechanisms described or referenced herein will sometimesbe described in singular form for clarity. However, it should beappreciated that particular aspects may include multiple iterations of atechnique or multiple instantiations of a mechanism unless notedotherwise. Process descriptions or blocks in figures should beunderstood as representing modules, segments, or portions of code whichinclude one or more executable instructions for implementing specificlogical functions or steps in the process. Alternate implementations areincluded within the scope of various aspects in which, for example,functions may be executed out of order from that shown or discussed,including substantially concurrently or in reverse order, depending onthe functionality involved, as would be understood by those havingordinary skill in the art.

Definitions

The term “bit” refers to the smallest unit of information that can bestored or transmitted. It is in the form of a binary digit (either 0 or1). In terms of hardware, the bit is represented as an electrical signalthat is either off (representing 0) or on (representing 1).

The term “byte” refers to a series of bits exactly eight bits in length.

The term “codebook” refers to a database containing sourceblocks eachwith a pattern of bits and reference code unique within that library.The terms “library” and “encoding/decoding library” are synonymous withthe term codebook.

The term “codeword” refers to the reference code form in which data isstored or transmitted in an aspect of the system. A codeword consists ofa reference code to a sourceblock in the library plus an indication ofthat sourceblock's location in a particular data set.

The terms “compression” and “deflation” as used herein mean therepresentation of data in a more compact form than the original dataset.Compression and/or deflation may be either “lossless”, in which the datacan be reconstructed in its original form without any loss of theoriginal data, or “lossy” in which the data can be reconstructed in itsoriginal form, but with some loss of the original data.

The terms “compression ratio” and “deflation ratio”, and as used hereinall mean the size of the original data relative to the size of thecompressed data (e.g., if the new data is 70% of the size of theoriginal, then the deflation/compression ratio is 70% or 0.7.)

The term “corrupt” refers to data which has been lost, removed, oraltered to such a degree that makes it inoperable or unusable by acomputing device.

The term “data” means information in any computer-readable form.

The term “data set” refers to a grouping of data for a particularpurpose. One example of a data set might be a word processing filecontaining text and formatting information.

The term “effective compression” or “effective compression ratio” refersto the additional amount data that can be stored using the method hereindescribed versus conventional data storage methods. Although the methodherein described is not data compression, per se, expressing theadditional capacity in terms of compression is a useful comparison.

The term “file-print” as used herein means a representation of thestatistical characteristics associated with the distribution ofinformation in the parsed contents of a file. In an embodiment,file-prints are generated by parsing each file into bytes (8 bits),analyzing the distribution of bytes in the parsed file, and generating a512 bit array, wherein the first 256 bits represent a mean value for thedistribution of bytes in the file and the second 256 bits represent avariance from the mean value for the distribution of bytes in the file.

The term “file signature” refers to a first plurality of bytes containedin a file which identifies the file type of the file. File signaturesare typically located at the beginning of a file.

The term “sourcepacket” as used herein means a packet of data receivedfor encoding or decoding. A sourcepacket may be a portion of a data set.

The term “sourceblock” as used herein means a defined number of bits orbytes used as the block size for encoding or decoding. A sourcepacketmay be divisible into a number of sourceblocks. As one non-limitingexample, a 1 megabyte sourcepacket of data may be encoded using 512 bytesourceblocks. The number of bits in a sourceblock may be dynamicallyoptimized by the system during operation. In one aspect, a sourceblockmay be of the same length as the block size used by a particular filesystem, typically 512 bytes or 4,096 bytes.

Conceptual Architecture

FIG. 1 is a diagram showing an embodiment 100 of the system in which allcomponents of the system are operated locally. As incoming data 101 isreceived by data deconstruction engine 102. Data deconstruction engine102 breaks the incoming data into sourceblocks, which are then sent tolibrary manager 103. Using the information contained in sourceblocklibrary lookup table 104 and sourceblock library storage 105, librarymanager 103 returns reference codes to data deconstruction engine 102for processing into codewords, which are stored in codeword storage 106.When a data retrieval request 107 is received, data reconstructionengine 108 obtains the codewords associated with the data from codewordstorage 106, and sends them to library manager 103. Library manager 103returns the appropriate sourceblocks to data reconstruction engine 108,which assembles them into the proper order and sends out the data in itsoriginal form 109.

FIG. 2 is a diagram showing an embodiment of one aspect 200 of thesystem, specifically data deconstruction engine 201. Incoming data 202is received by data analyzer 203, which optimally analyzes the databased on machine learning algorithms and input 204 from a sourceblocksize optimizer, which is disclosed below. Data analyzer may optionallyhave access to a sourceblock cache 205 of recently-processedsourceblocks, which can increase the speed of the system by avoidingprocessing in library manager 103. Based on information from dataanalyzer 203, the data is broken into sourceblocks by sourceblockcreator 206, which sends sourceblocks 207 to library manager 203 foradditional processing. Data deconstruction engine 201 receives referencecodes 208 from library manager 103, corresponding to the sourceblocks inthe library that match the sourceblocks sent by sourceblock creator 206,and codeword creator 209 processes the reference codes into codewordscomprising a reference code to a sourceblock and a location of thatsourceblock within the data set. The original data may be discarded, andthe codewords representing the data are sent out to storage 210.

FIG. 3 is a diagram showing an embodiment of another aspect of system300, specifically data reconstruction engine 301. When a data retrievalrequest 302 is received by data request receiver 303 (in the form of aplurality of codewords corresponding to a desired final data set), itpasses the information to data retriever 304, which obtains therequested data 305 from storage. Data retriever 304 sends, for eachcodeword received, a reference codes from the codeword 306 to librarymanager 103 for retrieval of the specific sourceblock associated withthe reference code. Data assembler 308 receives the sourceblock 307 fromlibrary manager 103 and, after receiving a plurality of sourceblockscorresponding to a plurality of codewords, assembles them into theproper order based on the location information contained in eachcodeword (recall each codeword comprises a sourceblock reference codeand a location identifier that specifies where in the resulting data setthe specific sourceblock should be restored to. The requested data isthen sent to user 309 in its original form.

FIG. 4 is a diagram showing an embodiment of another aspect of thesystem 400, specifically library manager 401. One function of librarymanager 401 is to generate reference codes from sourceblocks receivedfrom data deconstruction engine 301. As sourceblocks are received 402from data deconstruction engine 301, sourceblock lookup engine 403checks sourceblock library lookup table 404 to determine whether thosesourceblocks already exist in sourceblock library storage 105. If aparticular sourceblock exists in sourceblock library storage 105,reference code return engine 405 sends the appropriate reference code406 to data deconstruction engine 301. If the sourceblock does not existin sourceblock library storage 105, optimized reference code generator407 generates a new, optimized reference code based on machine learningalgorithms. Optimized reference code generator 407 then saves thereference code 408 to sourceblock library lookup table 104; saves theassociated sourceblock 409 to sourceblock library storage 105; andpasses the reference code to reference code return engine 405 forsending 406 to data deconstruction engine 301. Another function oflibrary manager 401 is to optimize the size of sourceblocks in thesystem. Based on information 411 contained in sourceblock library lookuptable 104, sourceblock size optimizer 410 dynamically adjusts the sizeof sourceblocks in the system based on machine learning algorithms andoutputs that information 412 to data analyzer 203. Another function oflibrary manager 401 is to return sourceblocks associated with referencecodes received from data reconstruction engine 301. As reference codesare received 414 from data reconstruction engine 301, reference codelookup engine 413 checks sourceblock library lookup table 415 toidentify the associated sourceblocks; passes that information tosourceblock retriever 416, which obtains the sourceblocks 417 fromsourceblock library storage 105; and passes them 418 to datareconstruction engine 301.

FIG. 5 is a diagram showing another embodiment of system 500, in whichdata is transferred between remote locations. As incoming data 501 isreceived by data deconstruction engine 502 at Location 1, datadeconstruction engine 301 breaks the incoming data into sourceblocks,which are then sent to library manager 503 at Location 1. Using theinformation contained in sourceblock library lookup table 504 atLocation 1 and sourceblock library storage 505 at Location 1, librarymanager 503 returns reference codes to data deconstruction engine 301for processing into codewords, which are transmitted 506 to datareconstruction engine 507 at Location 2. In the case where the referencecodes contained in a particular codeword have been newly generated bylibrary manager 503 at Location 1, the codeword is transmitted alongwith a copy of the associated sourceblock. As data reconstruction engine507 at Location 2 receives the codewords, it passes them to librarymanager module 508 at Location 2, which looks up the sourceblock insourceblock library lookup table 509 at Location 2, and retrieves theassociated from sourceblock library storage 510. Where a sourceblock hasbeen transmitted along with a codeword, the sourceblock is stored insourceblock library storage 510 and sourceblock library lookup table 504is updated. Library manager 503 returns the appropriate sourceblocks todata reconstruction engine 507, which assembles them into the properorder and sends the data in its original form 511.

FIG. 6 is a diagram showing an embodiment 600 in which a standardizedversion of a sourceblock library 603 and associated algorithms 604 wouldbe encoded as firmware 602 on a dedicated processing chip 601 includedas part of the hardware of a plurality of devices 600. Contained ondedicated chip 601 would be a firmware area 602, on which would bestored a copy of a standardized sourceblock library 603 anddeconstruction/reconstruction algorithms 604 for processing the data.Processor 605 would have both inputs 606 and outputs 607 to otherhardware on the device 600. Processor 605 would store incoming data forprocessing on on-chip memory 608, process the data using standardizedsourceblock library 603 and deconstruction/reconstruction algorithms604, and send the processed data to other hardware on device 600. Usingthis embodiment, the encoding and decoding of data would be handled bydedicated chip 601, keeping the burden of data processing off device's600 primary processors. Any device equipped with this embodiment wouldbe able to store and transmit data in a highly optimized,bandwidth-efficient format with any other device equipped with thisembodiment.

FIG. 12 is a diagram showing an exemplary system architecture 1200,according to a preferred embodiment of the invention. Incoming trainingdata sets may be received at a customized library generator 1300 thatprocesses training data to produce a customized word library 1201comprising key-value pairs of data words (each comprising a string ofbits) and their corresponding calculated binary Huffman codewords. Theresultant word library 1201 may then be processed by a library optimizer1400 to reduce size and improve efficiency, for example by pruninglow-occurrence data entries or calculating approximate codewords thatmay be used to match more than one data word. A transmissionencoder/decoder 1500 may be used to receive incoming data intended forstorage or transmission, process the data using a word library 1201 toretrieve codewords for the words in the incoming data, and then appendthe codewords (rather than the original data) to an outbound datastream. Each of these components is described in greater detail below,illustrating the particulars of their respective processing and otherfunctions, referring to FIGS. 2-4 .

System 1200 provides near-instantaneous source coding that isdictionary-based and learned in advance from sample training data, sothat encoding and decoding may happen concurrently with datatransmission. This results in computational latency that is near zerobut the data size reduction is comparable to classical compression. Forexample, if N bits are to be transmitted from sender to receiver, thecompression ratio of classical compression is C the ratio between thedeflation factor of system 1200 and that of multi-pass source coding isp, the classical compression encoding rate is R_(C) bit/s and thedecoding rate is R_(D) bit/s, and the transmission speed is S bit/s, thecompress-send-decompress time will be

$T_{old} = {\frac{N}{R_{C}} + \frac{N}{CS} + \frac{N}{CR_{D}}}$while the transmit-while-coding time for system 1200 will be (assumingthat encoding and decoding happen at least as quickly as networklatency):

$T_{new} = \frac{N_{p}}{CS}$so that the total data transit time improvement factor is

$\frac{T_{old}}{T_{new}} = \frac{\frac{CS}{R_{C}} + 1 + \frac{s}{R_{D}}}{p}$which presents a savings whenever

${\frac{CS}{R_{C}} + \frac{s}{R_{D}}} > {p - {1.}}$This is a reasonable scenario given that typical values in real-worldpractice are C=0.32, R_(C)=1.1·10¹², R_(D)=4.2·10¹², S=10¹¹, giving

${\frac{CS}{R_{C}} + \frac{s}{R_{D}}} = {{0.0}5{3.}}$such that system 1200 will outperform the total transit time of the bestcompression technology available as long as its deflation factor is nomore than 5% worse than compression. Such customized dictionary-basedencoding will also sometimes exceed the deflation ratio of classicalcompression, particularly when network speeds increase beyond 100 Gb/s.

The delay between data creation and its readiness for use at a receivingend will be equal to only the source word length t (typically 5-15bytes), divided by the deflation factor C/p and the network speed S,i.e.

${delay}_{{inve}ntion} = \frac{tp}{CS}$since encoding and decoding occur concurrently with data transmission.On the other hand, the latency associated with classical compression is

${delay_{priorart}} = {\frac{N}{R_{C}} + \frac{N}{CS} + \frac{N}{CR_{D}}}$where Nis the packet/file size. Even with the generous values chosenabove as well as N=512K, t=10, and p=1.05, this results indelay_(invention)≈3.3·10⁻¹⁰ while delay_(priorart)≈1.3·10⁻⁷, a more than400-fold reduction in latency.

A key factor in the efficiency of Huffman coding used by system 1200 isthat key-value pairs be chosen carefully to minimize expected codinglength, so that the average deflation/compression ratio is minimized. Itis possible to achieve the best possible expected code length among allinstantaneous codes using Huffman codes if one has access to the exactprobability distribution of source words of a given desired length fromthe random variable generating them. In practice this is impossible, asdata is received in a wide variety of formats and the random processesunderlying the source data are a mixture of human input, unpredictable(though in principle, deterministic) physical events, and noise. System1200 addresses this by restriction of data types and density estimation;training data is provided that is representative of the type of dataanticipated in “real-world” use of system 1200, which is then used tomodel the distribution of binary strings in the data in order to build aHuffman code word library 1200.

FIG. 13 is a diagram showing a more detailed architecture for acustomized library generator 1300. When an incoming training data set1301 is received, it may be analyzed using a frequency creator 1302 toanalyze for word frequency (that is, the frequency with which a givenword occurs in the training data set). Word frequency may be analyzed byscanning all substrings of bits and directly calculating the frequencyof each substring by iterating over the data set to produce anoccurrence frequency, which may then be used to estimate the rate ofword occurrence in non-training data. A first Huffman binary tree iscreated based on the frequency of occurrences of each word in the firstdataset, and a Huffman codeword is assigned to each observed word in thefirst dataset according to the first Huffman binary tree. Machinelearning may be utilized to improve results by processing a number oftraining data sets and using the results of each training set to refinethe frequency estimations for non-training data, so that the estimationyield better results when used with real-world data (rather than, forexample, being only based on a single training data set that may not bevery similar to a received non-training data set). A second Huffman treecreator 1303 may be utilized to identify words that do not match anyexisting entries in a word library 1201 and pass them to a hybridencoder/decoder 1304, that then calculates a binary Huffman codeword forthe mismatched word and adds the codeword and original data to the wordlibrary 1201 as a new key-value pair. In this manner, customized librarygenerator 1300 may be used both to establish an initial word library1201 from a first training set, as well as expand the word library 1201using additional training data to improve operation.

FIG. 14 is a diagram showing a more detailed architecture for a libraryoptimizer 1400. A pruner 1401 may be used to load a word library 1201and reduce its size for efficient operation, for example by sorting theword library 1201 based on the known occurrence probability of eachkey-value pair and removing low-probability key-value pairs based on aloaded threshold parameter. This prunes low-value data from the wordlibrary to trim the size, eliminating large quantities ofvery-low-frequency key-value pairs such as single-occurrence words thatare unlikely to be encountered again in a data set. Pruning eliminatesthe least-probable entries from word library 1201 up to a giventhreshold, which will have a negligible impact on the deflation factorsince the removed entries are only the least-common ones, while theimpact on word library size will be larger because samples drawn fromasymptotically normal distributions (such as the log-probabilities ofwords generated by a probabilistic finite state machine, a modelwell-suited to a wide variety of real-world data) which occur in tailsof the distribution are disproportionately large in counting measure. Adelta encoder 1402 may be utilized to apply delta encoding to aplurality of words to store an approximate codeword as a value in theword library, for which each of the plurality of source words is a validcorresponding key. This may be used to reduce library size by replacingnumerous key-value pairs with a single entry for the approximatecodeword and then represent actual codewords using the approximatecodeword plus a delta value representing the difference between theapproximate codeword and the actual codeword. Approximate coding isoptimized for low-weight sources such as Golomb coding, run-lengthcoding, and similar techniques. The approximate source words may bechosen by locality-sensitive hashing, so as to approximate Hammingdistance without incurring the intractability of nearest-neighbor-searchin Hamming space. A parametric optimizer 1403 may load configurationparameters for operation to optimize the use of the word library 1201during operation. Best-practice parameter/hyperparameter optimizationstrategies such as stochastic gradient descent, quasi-random gridsearch, and evolutionary search may be used to make optimal choices forall interdependent settings playing a role in the functionality ofsystem 1200. In cases where lossless compression is not required, thedelta value may be discarded at the expense of introducing some limitederrors into any decoded (reconstructed) data.

FIG. 15 is a diagram showing a more detailed architecture for atransmission encoder/decoder 1500. According to various arrangements,transmission encoder/decoder 1500 may be used to deconstruct data forstorage or transmission, or to reconstruct data that has been received,using a word library 1201. A library comparator 1501 may be used toreceive data comprising words or codewords, and compare against a wordlibrary 1201 by dividing the incoming stream into substrings of length tand using a fast hash to check word library 1201 for each substring. Ifa substring is found in word library 1201, the corresponding key/value(that is, the corresponding source word or codeword, according towhether the substring used in comparison was itself a word or codeword)is returned and appended to an output stream. If a given substring isnot found in word library 1201, a mismatch handler 1502 and hybridencoder/decoder 1503 may be used to handle the mismatch similarly tooperation during the construction or expansion of word library 1201. Amismatch handler 1502 may be utilized to identify words that do notmatch any existing entries in a word library 1201 and pass them to ahybrid encoder/decoder 1503, that then calculates a binary Huffmancodeword for the mismatched word and adds the codeword and original datato the word library 1201 as a new key-value pair. The newly-producedcodeword may then be appended to the output stream. In arrangementswhere a mismatch indicator is included in a received data stream, thismay be used to preemptively identify a substring that is not in wordlibrary 1201 (for example, if it was identified as a mismatch on thetransmission end), and handled accordingly without the need for alibrary lookup.

FIG. 19 is an exemplary system architecture of a data encoding systemused for cyber security purposes. Much like in FIG. 1 , incoming data101 to be deconstructed is sent to a data deconstruction engine 102,which may attempt to deconstruct the data and turn it into a collectionof codewords using a library manager 103. Codeword storage 106 serves tostore unique codewords from this process, and may be queried by a datareconstruction engine 108 which may reconstruct the original data fromthe codewords, using a library manager 103. However, a cybersecuritygateway 1900 is present, communicating in-between a library manager 103and a deconstruction engine 102, and containing an anomaly detector 1910and distributed denial of service (DDoS) detector 1920. The anomalydetector examines incoming data to determine whether there is adisproportionate number of incoming reference codes that do not matchreference codes in the existing library. A disproportionate number ofnon-matching reference codes may indicate that data is being receivedfrom an unknown source, of an unknown type, or contains unexpected(possibly malicious) data. If the disproportionate number ofnon-matching reference codes exceeds an established threshold orpersists for a certain length of time, the anomaly detector 1910 raisesa warning to a system administrator. Likewise, the DDoS detector 1920examines incoming data to determine whether there is a disproportionateamount of repetitive data. A disproportionate amount of repetitive datamay indicate that a DDoS attack is in progress. If the disproportionateamount of repetitive data exceeds an established threshold or persistsfor a certain length of time, the DDoS detector 1910 raises a warning toa system administrator. In this way, a data encoding system may detectand warn users of, or help mitigate, common cyber-attacks that resultfrom a flow of unexpected and potentially harmful data, or attacks thatresult from a flow of too much irrelevant data meant to slow down anetwork or system, as in the case of a DDoS attack.

FIG. 22 is an exemplary system architecture of a data encoding systemused for data mining and analysis purposes. Much like in FIG. 1 ,incoming data 101 to be deconstructed is sent to a data deconstructionengine 102, which may attempt to deconstruct the data and turn it into acollection of codewords using a library manager 103. Codeword storage106 serves to store unique codewords from this process, and may bequeried by a data reconstruction engine 108 which may reconstruct theoriginal data from the codewords, using a library manager 103. A dataanalysis engine 2210, typically operating while the system is otherwiseidle, sends requests for data to the data reconstruction engine 108,which retrieves the codewords representing the requested data fromcodeword storage 106, reconstructs them into the data represented by thecodewords, and send the reconstructed data to the data analysis engine2210 for analysis and extraction of useful data (i.e., data mining).Because the speed of reconstruction is significantly faster thandecompression using traditional compression technologies (i.e.,significantly less decompression latency), this approach makes datamining feasible. Very often, data stored using traditional compressionis not mined precisely because decompression lag makes it unfeasible,especially during shorter periods of system idleness. Increasing thespeed of data reconstruction broadens the circumstances under which datamining of stored data is feasible.

FIG. 24 is an exemplary system architecture of a data encoding systemused for remote software and firmware updates. Software and firmwareupdates typically require smaller, but more frequent, file transfers. Aserver which hosts a software or firmware update 2410 may host anencoding-decoding system 2420, allowing for data to be encoded into, anddecoded from, sourceblocks or codewords, as disclosed in previousfigures. Such a server may possess a software update, operating systemupdate, firmware update, device driver update, or any other form ofsoftware update, which in some cases may be minor changes to a file, butnevertheless necessitate sending the new, completed file to therecipient. Such a server is connected over a network 2430, which isfurther connected to a recipient computer 2440, which may be connectedto a server 2410 for receiving such an update to its system. In thisinstance, the recipient device 2440 also hosts the encoding and decodingsystem 2450, along with a codebook or library of reference codes thatthe hosting server 2410 also shares. The updates are retrieved fromstorage at the hosting server 2410 in the form of codewords, transferredover the network 2430 in the form of codewords, and reconstructed on thereceiving computer 2440. In this way, a far smaller file size, andsmaller total update size, may be sent over a network. The receivingcomputer 2440 may then install the updates on any number of targetcomputing devices 2460 a-n, using a local network or otherhigh-bandwidth connection.

FIG. 26 is an exemplary system architecture of a data encoding systemused for large-scale software installation such as operating systems.Large-scale software installations typically require very large, butinfrequent, file transfers. A server which hosts an installable software2610 may host an encoding-decoding system 2620, allowing for data to beencoded into, and decoded from, sourceblocks or codewords, as disclosedin previous figures. The files for the large scale software installationare hosted on the server 2610, which is connected over a network 2630 toa recipient computer 2640. In this instance, the encoding and decodingsystem 2650 a-n is stored on or connected to one or more target devices2660 a-n, along with a codebook or library of reference codes that thehosting server 2610 shares. The software is retrieved from storage atthe hosting server 2610 in the form of codewords, and transferred overthe network 2630 in the form of codewords to the receiving computer2640. However, instead of being reconstructed at the receiving computer2640, the codewords are transmitted to one or more target computingdevices, and reconstructed and installed directly on the target devices2660 a-n. In this way, a far smaller file size, and smaller total updatesize, may be sent over a network or transferred between computingdevices, even where the network 2630 between the receiving computer 2640and target devices 2660 a-n is low bandwidth, or where there are manytarget devices 2660 a-n.

Description of Method Aspects

Machine-learning based algorithms may improve the accuracy of theirresult by enhancing the dataset of which it reads on. By providing themachine learning with more data—such as is used in the case with thefile type identification system—the accuracy of its returned value maycontinuously be improved overtime by the addition of more data beingstored in its “training” dataset. The functionality of such a file typeidentification algorithm is intended to provide a predictive result fora file type based on the comparison of pre-existing data—which is datacontained in a dataset for the algorithm—and is compared to incomingdata which needs its file type identified.

To expand on this idea for the file identification system, if a file iscorrupt (which may occur from incomplete data transfers or even a usertampering with said file) it may be impossible to identify its file typebased on the file signature—which is a traditional method known by thoseskilled in the art for determining a file type. With such a case, torectify the situation of an unidentifiable file type the onlypossibility is to utilize what information is there to provide apredictive result for what the file type would be prior to itscorruption. Luckily, the binary information of files is often consistentamongst files of the same type, thus there is a possible method—of whichthis invention aims to provide and will be described herein—which allowsfor a means of determining an unknown file type.

Since the library consists of re-usable building sourceblocks, and theactual data is represented by reference codes to the library, the totalstorage space of a single set of data would be much smaller thanconventional methods, wherein the data is stored in its entirety. Themore data sets that are stored, the larger the library becomes, and themore data can be stored in reference code form.

As an analogy, imagine each data set as a collection of printed booksthat are only occasionally accessed. The amount of physical shelf spacerequired to store many collections would be quite large, and isanalogous to conventional methods of storing every single bit of data inevery data set. Consider, however, storing all common elements withinand across books in a single library, and storing the books asreferences codes to those common elements in that library. As a singlebook is added to the library, it will contain many repetitions of wordsand phrases. Instead of storing the whole words and phrases, they areadded to a library, and given a reference code, and stored as referencecodes. At this scale, some space savings may be achieved, but thereference codes will be on the order of the same size as the wordsthemselves. As more books are added to the library, larger phrases,quotations, and other words patterns will become common among the books.The larger the word patterns, the smaller the reference codes will be inrelation to them as not all possible word patterns will be used. Asentire collections of books are added to the library, sentences,paragraphs, pages, or even whole books will become repetitive. There maybe many duplicates of books within a collection and across multiplecollections, many references and quotations from one book to another,and much common phraseology within books on particular subjects. If eachunique page of a book is stored only once in a common library and givena reference code, then a book of 1,000 pages or more could be stored ona few printed pages as a string of codes referencing the properfull-sized pages in the common library. The physical space taken up bythe books would be dramatically reduced. The more collections that areadded, the greater the likelihood that phrases, paragraphs, pages, orentire books will already be in the library, and the more information ineach collection of books can be stored in reference form. Accessingentire collections of books is then limited not by physical shelf space,but by the ability to reprint and recycle the books as needed for use.

The projected increase in storage capacity using the method hereindescribed is primarily dependent on two factors: 1) the ratio of thenumber of bits in a block to the number of bits in the reference code,and 2) the amount of repetition in data being stored by the system.

With respect to the first factor, the number of bits used in thereference codes to the sourceblocks must be smaller than the number ofbits in the sourceblocks themselves in order for any additional datastorage capacity to be obtained. As a simple example, 16-bitsourceblocks would require 2¹⁶, or 65536, unique reference codes torepresent all possible patterns of bits. If all possible 65536 blockspatterns are utilized, then the reference code itself would also need tocontain sixteen bits in order to refer to all possible 65,536 blockspatterns. In such case, there would be no storage savings. However, ifonly 16 of those block patterns are utilized, the reference code can bereduced to 4 bits in size, representing an effective compression of 4times (16 bits/4 bits=4) versus conventional storage. Using a typicalblock size of 512 bytes, or 4,096 bits, the number of possible blockpatterns is 2^(4,096), which for all practical purposes is unlimited. Atypical hard drive contains one terabyte (TB) of physical storagecapacity, which represents 1,953,125,000, or roughly 2³¹, 512 byteblocks. Assuming that 1 TB of unique 512-byte sourceblocks werecontained in the library, and that the reference code would thus need tobe 31 bits long, the effective compression ratio for stored data wouldbe on the order of 132 times (4,096/31≈132) that of conventionalstorage.

With respect to the second factor, in most cases it could be assumedthat there would be sufficient repetition within a data set such that,when the data set is broken down into sourceblocks, its size within thelibrary would be smaller than the original data. However, it isconceivable that the initial copy of a data set could require somewhatmore storage space than the data stored in a conventional manner, if allor nearly all sourceblocks in that set were unique. For example,assuming that the reference codes are 1/10^(th) the size of a full-sizedcopy, the first copy stored as sourceblocks in the library would need tobe 1.1 megabytes (MB), (1 MB for the complete set of full-sizedsourceblocks in the library and 0.1 MB for the reference codes).However, since the sourceblocks stored in the library are universal, themore duplicate copies of something you save, the greater efficiencyversus conventional storage methods. Conventionally, storing 10 copiesof the same data requires 10 times the storage space of a single copy.For example, ten copies of a 1 MB file would take up 10 MB of storagespace. However, using the method described herein, only a singlefull-sized copy is stored, and subsequent copies are stored as referencecodes. Each additional copy takes up only a fraction of the space of thefull-sized copy. For example, again assuming that the reference codesare 1/10^(th) the size of the full-size copy, ten copies of a 1 MB filewould take up only 2 MB of space (1 MB for the full-sized copy, and 0.1MB each for ten sets of reference codes). The larger the library, themore likely that part or all of incoming data will duplicatesourceblocks already existing in the library.

The size of the library could be reduced in a manner similar to storageof data. Where sourceblocks differ from each other only by a certainnumber of bits, instead of storing a new sourceblock that is verysimilar to one already existing in the library, the new sourceblockcould be represented as a reference code to the existing sourceblock,plus information about which bits in the new block differ from theexisting block. For example, in the case where 512 byte sourceblocks arebeing used, if the system receives a new sourceblock that differs byonly one bit from a sourceblock already existing in the library, insteadof storing a new 512 byte sourceblock, the new sourceblock could bestored as a reference code to the existing sourceblock, plus a referenceto the bit that differs. Storing the new sourceblock as a reference codeplus changes would require only a few bytes of physical storage spaceversus the 512 bytes that a full sourceblock would require. Thealgorithm could be optimized to store new sourceblocks in this referencecode plus changes form unless the changes portion is large enough thatit is more efficient to store a new, full sourceblock.

It will be understood by one skilled in the art that transfer andsynchronization of data would be increased to the same extent as forstorage. By transferring or synchronizing reference codes instead offull-sized data, the bandwidth requirements for both types of operationsare dramatically reduced.

In addition, the method described herein is inherently a form ofencryption. When the data is converted from its full form to referencecodes, none of the original data is contained in the reference codes.Without access to the library of sourceblocks, it would be impossible tore-construct any portion of the data from the reference codes. Thisinherent property of the method described herein could obviate the needfor traditional encryption algorithms, thereby offsetting most or all ofthe computational cost of conversion of data back and forth to referencecodes. In theory, the method described herein should not utilize anyadditional computing power beyond traditional storage using encryptionalgorithms. Alternatively, the method described herein could be inaddition to other encryption algorithms to increase data security evenfurther.

In other embodiments, additional security features could be added, suchas: creating a proprietary library of sourceblocks for proprietarynetworks, physical separation of the reference codes from the library ofsourceblocks, storage of the library of sourceblocks on a removabledevice to enable easy physical separation of the library and referencecodes from any network, and incorporation of proprietary sequences ofhow sourceblocks are read and the data reassembled.

FIG. 7 is a diagram showing an example of how data might be convertedinto reference codes using an aspect of an embodiment 700. As data isreceived 701, it is read by the processor in sourceblocks of a sizedynamically determined by the previously disclosed sourceblock sizeoptimizer 410. In this example, each sourceblock is 16 bits in length,and the library 702 initially contains three sourceblocks with referencecodes 00, 01, and 10. The entry for reference code 11 is initiallyempty. As each 16 bit sourceblock is received, it is compared with thelibrary. If that sourceblock is already contained in the library, it isassigned the corresponding reference code. So, for example, as the firstline of data (0000 0011 0000 0000) is received, it is assigned thereference code (01) associated with that sourceblock in the library. Ifthat sourceblock is not already contained in the library, as is the casewith the third line of data (0000 1111 0000 0000) received in theexample, that sourceblock is added to the library and assigned areference code, in this case 11. The data is thus converted 703 to aseries of reference codes to sourceblocks in the library. The data isstored as a collection of codewords, each of which contains thereference code to a sourceblock and information about the location ofthe sourceblocks in the data set. Reconstructing the data is performedby reversing the process. Each stored reference code in a datacollection is compared with the reference codes in the library, thecorresponding sourceblock is read from the library, and the data isreconstructed into its original form.

FIG. 8 is a method diagram showing the steps involved in using anembodiment 800 to store data. As data is received 801, it would bedeconstructed into sourceblocks 802, and passed 803 to the librarymanagement module for processing. Reference codes would be received back804 from the library management module, and could be combined withlocation information to create codewords 805, which would then be stored806 as representations of the original data.

FIG. 9 is a method diagram showing the steps involved in using anembodiment 900 to retrieve data. When a request for data is received901, the associated codewords would be retrieved 902 from the library.The codewords would be passed 903 to the library management module, andthe associated sourceblocks would be received back 904. Upon receipt,the sourceblocks would be assembled 905 into the original data using thelocation data contained in the codewords, and the reconstructed datawould be sent out 906 to the requestor.

FIG. 10 is a method diagram showing the steps involved in using anembodiment 1000 to encode data. As sourceblocks are received 1001 fromthe deconstruction engine, they would be compared 1002 with thesourceblocks already contained in the library. If that sourceblockalready exists in the library, the associated reference code would bereturned 1005 to the deconstruction engine. If the sourceblock does notalready exist in the library, a new reference code would be created 1003for the sourceblock. The new reference code and its associatedsourceblock would be stored 1004 in the library, and the reference codewould be returned to the deconstruction engine.

FIG. 11 is a method diagram showing the steps involved in using anembodiment 1100 to decode data. As reference codes are received 1101from the reconstruction engine, the associated sourceblocks areretrieved 1102 from the library, and returned 1103 to the reconstructionengine.

FIG. 16 is a method diagram illustrating key system functionalityutilizing an encoder and decoder pair, according to a preferredembodiment. In a first step 1601, at least one incoming data set may bereceived at a customized library generator 1300 that then 1602 processesdata to produce a customized word library 1201 comprising key-valuepairs of data words (each comprising a string of bits) and theircorresponding calculated binary Huffman codewords. A subsequent datasetmay be received, and compared to the word library 1603 to determine theproper codewords to use in order to encode the dataset. Words in thedataset are checked against the word library and appropriate encodingsare appended to a data stream 1604. If a word is mismatched within theword library and the dataset, meaning that it is present in the datasetbut not the word library, then a mismatched code is appended, followedby the unencoded original word. If a word has a match within the wordlibrary, then the appropriate codeword in the word library is appendedto the data stream. Such a data stream may then be stored or transmitted1605 to a destination as desired. For the purposes of decoding, analready-encoded data stream may be received and compared 1606, andun-encoded words may be appended to a new data stream 1607 depending onword matches found between the encoded data stream and the word librarythat is present. A matching codeword that is found in a word library isreplaced with the matching word and appended to a data stream, and amismatch code found in a data stream is deleted and the followingunencoded word is re-appended to a new data stream, the inverse of theprocess of encoding described earlier. Such a data stream may then bestored or transmitted 1608 as desired.

FIG. 17 is a method diagram illustrating possible use of a hybridencoder/decoder to improve the compression ratio, according to apreferred aspect. A second Huffman binary tree may be created 1701,having a shorter maximum length of codewords than a first Huffman binarytree 1602, allowing a word library to be filled with every combinationof codeword possible in this shorter Huffman binary tree 1702. A wordlibrary may be filled with these Huffman codewords and words from adataset 1702, such that a hybrid encoder/decoder 1304, 1503 may receiveany mismatched words from a dataset for which encoding has beenattempted with a first Huffman binary tree 1703, 1604 and parsepreviously mismatched words into new partial codewords (that is,codewords that are each a substring of an original mismatched codeword)using the second Huffman binary tree 1704. In this way, an incompleteword library may be supplemented by a second word library. New codewordsattained in this way may then be returned to a transmission encoder1705, 1500. In the event that an encoded dataset is received fordecoding, and there is a mismatch code indicating that additional codingis needed, a mismatch code may be removed and the unencoded word used togenerate a new codeword as before 1706, so that a transmission encoder1500 may have the word and newly generated codeword added to its wordlibrary 1707, to prevent further mismatching and errors in encoding anddecoding.

It will be recognized by a person skilled in the art that the methodsdescribed herein can be applied to data in any form. For example, themethod described herein could be used to store genetic data, which hasfour data units: C, G, A, and T. Those four data units can berepresented as 2 bit sequences: 00, 01, 10, and 11, which can beprocessed and stored using the method described herein.

It will be recognized by a person skilled in the art that certainembodiments of the methods described herein may have uses other thandata storage. For example, because the data is stored in reference codeform, it cannot be reconstructed without the availability of the libraryof sourceblocks. This is effectively a form of encryption, which couldbe used for cyber security purposes. As another example, an embodimentof the method described herein could be used to store backup copies ofdata, provide for redundancy in the event of server failure, or provideadditional security against cyberattacks by distributing multiplepartial copies of the library among computers are various locations,ensuring that at least two copies of each sourceblock exist in differentlocations within the network.

FIG. 18 is a flow diagram illustrating the use of a data encoding systemused to recursively encode data to further reduce data size. Data may beinput 1805 into a data deconstruction engine 102 to be deconstructedinto code references, using a library of code references based on theinput 1810. Such example data is shown in a converted, encoded format1815, highly compressed, reducing the example data from 96 bits of data,to 12 bits of data, before sending this newly encoded data through theprocess again 1820, to be encoded by a second library 1825, reducing iteven further. The newly converted data 1830 is shown as only 6 bits inthis example, thus a size of 6.25% of the original data packet. Withrecursive encoding, then, it is possible and implemented in the systemto achieve increasing compression ratios, using multi-layered encoding,through recursively encoding data. Both initial encoding libraries 1810and subsequent libraries 1825 may be achieved through machine learningtechniques to find optimal encoding patterns to reduce size, with thelibraries being distributed to recipients prior to transfer of theactual encoded data, such that only the compressed data 1830 must betransferred or stored, allowing for smaller data footprints andbandwidth requirements. This process can be reversed to reconstruct thedata. While this example shows only two levels of encoding, recursiveencoding may be repeated any number of times. The number of levels ofrecursive encoding will depend on many factors, a non-exhaustive list ofwhich includes the type of data being encoded, the size of the originaldata, the intended usage of the data, the number of instances of databeing stored, and available storage space for codebooks and libraries.Additionally, recursive encoding can be applied not only to data to bestored or transmitted, but also to the codebooks and/or libraries,themselves. For example, many installations of different libraries couldtake up a substantial amount of storage space. Recursively encodingthose different libraries to a single, universal library woulddramatically reduce the amount of storage space required, and eachdifferent library could be reconstructed as necessary to reconstructincoming streams of data.

FIG. 20 is a flow diagram of an exemplary method used to detectanomalies in received encoded data and producing a warning. A system mayhave trained encoding libraries 2010, before data is received from somesource such as a network connected device or a locally connected deviceincluding USB connected devices, to be decoded 2020. Decoding in thiscontext refers to the process of using the encoding libraries to takethe received data and attempt to use encoded references to decode thedata into its original source 2030, potentially more than once ifrecursive encoding was used, but not necessarily more than once. Ananomaly detector 1910 may be configured to detect a large amount ofun-encoded data 2040 in the midst of encoded data, by locating data orreferences that do not appear in the encoding libraries, indicating atleast an anomaly, and potentially data tampering or faulty encodinglibraries. A flag or warning is set by the system 2050, allowing a userto be warned at least of the presence of the anomaly and thecharacteristics of the anomaly. However, if a large amount of invalidreferences or unencoded data are not present in the encoded data that isattempting to be decoded, the data may be decoded and output as normal2060, indicating no anomaly has been detected.

FIG. 21 is a flow diagram of a method used for Distributed Denial ofService (DDoS) attack denial. A system may have trained encodinglibraries 2110, before data is received from some source such as anetwork connected device or a locally connected device including USBconnected devices, to be decoded 2120. Decoding in this context refersto the process of using the encoding libraries to take the received dataand attempt to use encoded references to decode the data into itsoriginal source 2130, potentially more than once if recursive encodingwas used, but not necessarily more than once. A DDoS detector 1920 maybe configured to detect a large amount of repeating data 2140 in theencoded data, by locating data or references that repeat many times over(the number of which can be configured by a user or administrator asneed be), indicating a possible DDoS attack. A flag or warning is set bythe system 2150, allowing a user to be warned at least of the presenceof a possible DDoS attack, including characteristics about the data andsource that initiated the flag, allowing a user to then block incomingdata from that source. However, if a large amount of repeat data in ashort span of time is not detected, the data may be decoded and outputas normal 2160, indicating no DDoS attack has been detected.

FIG. 23 is a flow diagram of an exemplary method used to enablehigh-speed data mining of repetitive data. A system may have trainedencoding libraries 2310, before data is received from some source suchas a network connected device or a locally connected device includingUSB connected devices, to be analyzed 2320 and decoded 2330. Whendetermining data for analysis, users may select specific data todesignate for decoding 2330, before running any data mining or analyticsfunctions or software on the decoded data 2340. Rather than havingtraditional decryption and decompression operate over distributeddrives, data can be regenerated immediately using the encoding librariesdisclosed herein, as it is being searched. Using methods described inFIG. 9 and FIG. 11 , data can be stored, retrieved, and decoded swiftlyfor searching, even across multiple devices, because the encodinglibrary may be on each device. For example, if a group of servers hostcodewords relevant for data mining purposes, a single computer canrequest these codewords, and the codewords can be sent to the recipientswiftly over the bandwidth of their connection, allowing the recipientto locally decode the data for immediate evaluation and searching,rather than running slow, traditional decompression algorithms on datastored across multiple devices or transfer larger sums of data acrosslimited bandwidth.

FIG. 25 is a flow diagram of an exemplary method used to encode andtransfer software and firmware updates to a device for installation, forthe purposes of reduced bandwidth consumption. A first system may havetrained code libraries or “codebooks” present 2510, allowing for asoftware update of some manner to be encoded 2520. Such a softwareupdate may be a firmware update, operating system update, securitypatch, application patch or upgrade, or any other type of softwareupdate, patch, modification, or upgrade, affecting any computer system.A codebook for the patch must be distributed to a recipient 2530, whichmay be done beforehand and either over a network or through a local orphysical connection, but must be accomplished at some point in theprocess before the update may be installed on the recipient device 2560.An update may then be distributed to a recipient device 2540, allowing arecipient with a codebook distributed to them 2530 to decode the update2550 before installation 2560. In this way, an encoded and thus heavilycompressed update may be sent to a recipient far quicker and with lessbandwidth usage than traditional lossless compression methods for data,or when sending data in uncompressed formats. This especially maybenefit large distributions of software and software updates, as withenterprises updating large numbers of devices at once.

FIG. 27 is a flow diagram of an exemplary method used to encode newsoftware and operating system installations for reduced bandwidthrequired for transference. A first system may have trained codelibraries or “codebooks” present 2710, allowing for a softwareinstallation of some manner to be encoded 2720. Such a softwareinstallation may be a software update, operating system, securitysystem, application, or any other type of software installation,execution, or acquisition, affecting a computer system. An encodinglibrary or “codebook” for the installation must be distributed to arecipient 2730, which may be done beforehand and either over a networkor through a local or physical connection, but must be accomplished atsome point in the process before the installation can begin on therecipient device 2760. An installation may then be distributed to arecipient device 2740, allowing a recipient with a codebook distributedto them 2730 to decode the installation 2750 before executing theinstallation 2760. In this way, an encoded and thus heavily compressedsoftware installation may be sent to a recipient far quicker and withless bandwidth usage than traditional lossless compression methods fordata, or when sending data in uncompressed formats. This especially maybenefit large distributions of software and software updates, as withenterprises updating large numbers of devices at once.

FIG. 28 is an exemplary system architecture diagram for a fileclassification system used for determining a file type 2800. As a fileis received 2802, a file signature extractor 3200 attempts to find andread a file signature of the file. The file signature extractor 3200 maysearch a file signature database 2804 to determine the expected locationand structure of the file signature. If a file signature is found and isreadable, the file type determining process is concluded and the filemay be routed (along with its file type information) for furtherprocessing, such as to a codebook lookup table 2808 whereby the dataencoder 2809 may encode the file based on a codebook associated withthat file type in the database. If the file type determining process isconcluded after a file signature is found, the file print extractor andfile classifier may be instructed to cease operations, as the file typehas already been determined.

If the file signature is not recognized in file-signature database 2804,or is recognized as a general text-based file type such as .ascii whichis used for storing many different types of information, the file isrouted to a file-print extraction algorithm 2805 which parses file intobytes and performs statistical analyses on the parsed file to generatethe file's “file-print.” The file-print may be generated by a machinelearning algorithm trained on file-prints stored in a file-printdatabase 2806. The file-print is sent to a file classifier, which uses atrained machine learning algorithm to identify a file type based on thefile-print.

FIG. 29 is a flow diagram illustrating an exemplary process fordetermining whether a file should be passed as input to amachine-learning based classification algorithm. A file, which may belocally stored on a computing device or sent/received over a network, isscanned for a file signature 2901, which is typically contained at thebeginning of the file. The scan may be based on a list of filesignatures stored in a database that contains the locations andstructure of known file signatures 2902. If a file signature isrecognized the file may be sent for further processing such as selectionof a codebook for encoding files of the type contained in the filesignature 2904, and encoding of the file based on the selected codebook2905. If the file signature is missing or not recognized, the file issent to a file classifier for further identification based onfile-printing 2903.

FIG. 30 is flowchart describing an exemplary file-print extractionprocess. In this example, a file is parsed into bytes (here shown aspairs of hexadecimal values) 3002, 3003. A data analyzer 3004 performsstatistical calculations of the distribution of bytes in the parsed fileand, in this simplified example, generates a 24-bit array file print3005, wherein the first 12 bits represent a mean value for thedistribution of bytes in the file and the second 12 bits represent avariance from the mean value for the distribution of bytes in the file.The file-print 3005 is then sent to a file classifier 3100 which uses atrained machine learning algorithm to identify the file type. While asimplified 24-bit file print 3005 is shown here, larger file-prints willtypically be used.

FIG. 31 is an exemplary process for file type identification using afile classifier. The file classifier 3100 uses a trained machinelearning algorithm to identify the file type of an unknown file from itsfile-print 3105. The machine learning algorithm is trained onfile-prints for a plurality of files of known types. A file typetraining set 3101 may comprise file-prints 3102 derived from manythousands or millions of files 3103, each file-print 3102 comprising anarray containing a mean value of the occurrence of each byte in thedistribution of bytes in the file 3102 a and a standard deviation of themean value of the number of occurrences from the mean value of theexpected number of occurrences 3102 b. This simplified diagram showsfile-prints with an array of 18 bits, with the mean value 3102 a being 9bits and the standard deviation 3102 b being 9 bits, but real-workapplications would typically contain larger arrays.

After the machine learning algorithm 3107 is trained using the file typetraining sets 3101, file-prints for files of unknown types 3105 may bepassed through the machine learning algorithm 3107 which will identifythe file type of the unknown file based on its training. The machinelearning algorithm's data may be stored in a file-print database 3104,and confirmations of properly-identified files may be used as trainingdata to further improve the machine learning algorithm's accuracy.

In some embodiments, a file-print may be sent through the machinelearning algorithm more than once, and comparisons may be made betweenthe file type predictions of the algorithm after each pass-through. Insome embodiments, parameters for mean and variance may be altered witheach pass-through of the algorithm until a sufficiently similarfile-print for a known file type is identified. Limits may be imposed onthe amount of pass-throughs for the algorithm whereby reaching saidlimit may prompt the user with its lack of satisfactory result (which isa value that may be determined by the implementation from theprogrammer).

In some embodiments, a minimum file size may be required so that eachfile contains a sufficient amount of data to generate valid statisticaldata to allow for the binary distribution analysis method describedherein. In some cases, for example when a file is corrupted or the fileis very short, there may not be enough binary information to develop avalid file-print for the file.

In some embodiments, the machine learning algorithm 3107 may produce aprobability that the identified or predicted file type is correct. Insuch cases, threshold values may be established to require a certainpercentage of similarity amongst the binary distribution-based analysisresults of an unidentified file type with a certain file type containedin a database of file types before determining its file type prediction3106. For example, if the machine learning algorithm 3107 conducts apass through of a parsed file and determines that its prediction iscorrect only to a low probability (for example, 25%), the machinelearning algorithm 3107 may go through repeated pass-throughs, butre-parsing the file into a different grouping at each pass-through. Forexample, if the file is initially parsed at every 2 bytes, in subsequentpass-throughs, the file might be parsed at 3 bytes, and then 4 bytes,etc., to see if the machine learning algorithm 3107 identifies a filetype with a higher probability of accuracy, depending on the parsing ofthe file.

FIG. 32 is a flow diagram which illustrates an exemplary operation of afile signature extractor. A file signature is parsed to determine if afile type is identifiable, this is a process which may be done prior tohaving its parsed byte information routed to an algorithm for receivingits file-print to determine if said algorithm is necessary. The filesignature information, which is often contained in the first initialbytes of a file, is a unique code specific to a given file type. Anexample of such a file signature is the four-byte sequence “FF D8 FFE0,” which is the file signature for JPEG images, as shown in 3203.After a file 3202 is parsed for the file signature information 3203, thevalues are compared to a database which contains at least a plurality offile signatures of known file types 3204. If the file is identifiable,which is to say it has a file signature value which corresponds with afile signature of a known file type contained in the file signaturedatabase, it may have its file type predicted 3205. If the filesignature is not identifiable, which is to say no file signature of thesame value is present in the database for file signatures, the file isrouted to a file-print extraction algorithm 3000 which may conduct abinary distribution-based analysis for providing a file-print to amachine-learning algorithm described herein for determining its filetype.

According to an embodiment, the file-print information for a file whichis identifiable may still have its file-print extracted and sent to afile-print database 3104 containing file-prints for known file type.This may allow for increasing the training dataset at an enhanced rate,which is an essential component for the machine-learning algorithm toimprove its predictive file type result.

According to an embodiment, the file signature may be a generaltext-based file type such as .ascii. Said file type may have a widerange of realizable file types contained in its bit information. In sucha case, the machine-learning based algorithm described herein maydetermine a prediction for its file type using file-print informationinstead of (or in conjunction with) its file signature.

In another aspect, said file may not contain file signature informationin the first of a plurality of bytes. The algorithm 3000, which utilizesmachine-learning/AI functionality, may be able to determine the filetype through comparisons with ‘training sets’ contained in a database.Said training sets are files of the same file type, which have had theirbinary information parsed and analyzed using the methods describedherein, and may be used for providing a larger dataset for themachine-learning algorithm to compare to thus potentially improving theaccuracy of the predictive result for a file type.

Hardware Architecture

Generally, the techniques disclosed herein may be implemented onhardware or a combination of software and hardware. For example, theymay be implemented in an operating system kernel, in a separate userprocess, in a library package bound into network applications, on aspecially constructed machine, on an application-specific integratedcircuit (ASIC), or on a network interface card.

Software/hardware hybrid implementations of at least some of the aspectsdisclosed herein may be implemented on a programmable network-residentmachine (which should be understood to include intermittently connectednetwork-aware machines) selectively activated or reconfigured by acomputer program stored in memory. Such network devices may havemultiple network interfaces that may be configured or designed toutilize different types of network communication protocols. A generalarchitecture for some of these machines may be described herein in orderto illustrate one or more exemplary means by which a given unit offunctionality may be implemented. According to specific aspects, atleast some of the features or functionalities of the various aspectsdisclosed herein may be implemented on one or more general-purposecomputers associated with one or more networks, such as for example anend-user computer system, a client computer, a network server or otherserver system, a mobile computing device (e.g., tablet computing device,mobile phone, smartphone, laptop, or other appropriate computingdevice), a consumer electronic device, a music player, or any othersuitable electronic device, router, switch, or other suitable device, orany combination thereof. In at least some aspects, at least some of thefeatures or functionalities of the various aspects disclosed herein maybe implemented in one or more virtualized computing environments (e.g.,network computing clouds, virtual machines hosted on one or morephysical computing machines, or other appropriate virtual environments).

Referring now to FIG. 33 , there is shown a block diagram depicting anexemplary computing device 10 suitable for implementing at least aportion of the features or functionalities disclosed herein. Computingdevice 10 may be, for example, any one of the computing machines listedin the previous paragraph, or indeed any other electronic device capableof executing software- or hardware-based instructions according to oneor more programs stored in memory. Computing device 10 may be configuredto communicate with a plurality of other computing devices, such asclients or servers, over communications networks such as a wide areanetwork a metropolitan area network, a local area network, a wirelessnetwork, the Internet, or any other network, using known protocols forsuch communication, whether wireless or wired.

In one aspect, computing device 10 includes one or more centralprocessing units (CPU) 12, one or more interfaces 15, and one or morebusses 14 (such as a peripheral component interconnect (PCI) bus). Whenacting under the control of appropriate software or firmware, CPU 12 maybe responsible for implementing specific functions associated with thefunctions of a specifically configured computing device or machine. Forexample, in at least one aspect, a computing device 10 may be configuredor designed to function as a server system utilizing CPU 12, localmemory 11 and/or remote memory 16, and interface(s) 15. In at least oneaspect, CPU 12 may be caused to perform one or more of the differenttypes of functions and/or operations under the control of softwaremodules or components, which for example, may include an operatingsystem and any appropriate applications software, drivers, and the like.

CPU 12 may include one or more processors 13 such as, for example, aprocessor from one of the Intel, ARM, Qualcomm, and AMD families ofmicroprocessors. In some aspects, processors 13 may include speciallydesigned hardware such as application-specific integrated circuits(ASICs), electrically erasable programmable read-only memories(EEPROMs), field-programmable gate arrays (FPGAs), and so forth, forcontrolling operations of computing device 10. In a particular aspect, alocal memory 11 (such as non-volatile random access memory (RAM) and/orread-only memory (ROM), including for example one or more levels ofcached memory) may also form part of CPU 12. However, there are manydifferent ways in which memory may be coupled to system 10. Memory 11may be used for a variety of purposes such as, for example, cachingand/or storing data, programming instructions, and the like. It shouldbe further appreciated that CPU 12 may be one of a variety ofsystem-on-a-chip (SOC) type hardware that may include additionalhardware such as memory or graphics processing chips, such as a QUALCOMMSNAPDRAGON™ or SAMSUNG EXYNOS™ CPU as are becoming increasingly commonin the art, such as for use in mobile devices or integrated devices.

As used herein, the term “processor” is not limited merely to thoseintegrated circuits referred to in the art as a processor, a mobileprocessor, or a microprocessor, but broadly refers to a microcontroller,a microcomputer, a programmable logic controller, anapplication-specific integrated circuit, and any other programmablecircuit.

In one aspect, interfaces 15 are provided as network interface cards(NICs). Generally, NICs control the sending and receiving of datapackets over a computer network; other types of interfaces 15 may forexample support other peripherals used with computing device 10. Amongthe interfaces that may be provided are Ethernet interfaces, frame relayinterfaces, cable interfaces, DSL interfaces, token ring interfaces,graphics interfaces, and the like. In addition, various types ofinterfaces may be provided such as, for example, universal serial bus(USB), Serial, Ethernet, FIREWIRE™, THUNDERBOLT™, PCI, parallel, radiofrequency (RF), BLUETOOTH™, near-field communications (e.g., usingnear-field magnetics), 802.11 (Wi-Fi), frame relay, TCP/IP, ISDN, fastEthernet interfaces, Gigabit Ethernet interfaces, Serial ATA (SATA) orexternal SATA (ESATA) interfaces, high-definition multimedia interface(HDMI), digital visual interface (DVI), analog or digital audiointerfaces, asynchronous transfer mode (ATM) interfaces, high-speedserial interface (HSSI) interfaces, Point of Sale (POS) interfaces,fiber data distributed interfaces (FDDIs), and the like. Generally, suchinterfaces 15 may include physical ports appropriate for communicationwith appropriate media. In some cases, they may also include anindependent processor (such as a dedicated audio or video processor, asis common in the art for high-fidelity AN hardware interfaces) and, insome instances, volatile and/or non-volatile memory (e.g., RAM).

Although the system shown in FIG. 33 illustrates one specificarchitecture for a computing device 10 for implementing one or more ofthe aspects described herein, it is by no means the only devicearchitecture on which at least a portion of the features and techniquesdescribed herein may be implemented. For example, architectures havingone or any number of processors 13 may be used, and such processors 13may be present in a single device or distributed among any number ofdevices. In one aspect, a single processor 13 handles communications aswell as routing computations, while in other aspects a separatededicated communications processor may be provided. In various aspects,different types of features or functionalities may be implemented in asystem according to the aspect that includes a client device (such as atablet device or smartphone running client software) and server systems(such as a server system described in more detail below).

Regardless of network device configuration, the system of an aspect mayemploy one or more memories or memory modules (such as, for example,remote memory block 16 and local memory 11) configured to store data,program instructions for the general-purpose network operations, orother information relating to the functionality of the aspects describedherein (or any combinations of the above). Program instructions maycontrol execution of or comprise an operating system and/or one or moreapplications, for example. Memory 16 or memories 11, 16 may also beconfigured to store data structures, configuration data, encryptiondata, historical system operations information, or any other specific orgeneric non-program information described herein.

Because such information and program instructions may be employed toimplement one or more systems or methods described herein, at least somenetwork device aspects may include nontransitory machine-readablestorage media, which, for example, may be configured or designed tostore program instructions, state information, and the like forperforming various operations described herein. Examples of suchnontransitory machine-readable storage media include, but are notlimited to, magnetic media such as hard disks, floppy disks, andmagnetic tape; optical media such as CD-ROM disks; magneto-optical mediasuch as optical disks, and hardware devices that are speciallyconfigured to store and perform program instructions, such as read-onlymemory devices (ROM), flash memory (as is common in mobile devices andintegrated systems), solid state drives (SSD) and “hybrid SSD” storagedrives that may combine physical components of solid state and hard diskdrives in a single hardware device (as are becoming increasingly commonin the art with regard to personal computers), memristor memory, randomaccess memory (RAM), and the like. It should be appreciated that suchstorage means may be integral and non-removable (such as RAM hardwaremodules that may be soldered onto a motherboard or otherwise integratedinto an electronic device), or they may be removable such as swappableflash memory modules (such as “thumb drives” or other removable mediadesigned for rapidly exchanging physical storage devices),“hot-swappable” hard disk drives or solid state drives, removableoptical storage discs, or other such removable media, and that suchintegral and removable storage media may be utilized interchangeably.Examples of program instructions include both object code, such as maybe produced by a compiler, machine code, such as may be produced by anassembler or a linker, byte code, such as may be generated by forexample a JAVA™ compiler and may be executed using a Java virtualmachine or equivalent, or files containing higher level code that may beexecuted by the computer using an interpreter (for example, scriptswritten in Python, Perl, Ruby, Groovy, or any other scripting language).

In some aspects, systems may be implemented on a standalone computingsystem. Referring now to FIG. 34 , there is shown a block diagramdepicting a typical exemplary architecture of one or more aspects orcomponents thereof on a standalone computing system. Computing device 20includes processors 21 that may run software that carry out one or morefunctions or applications of aspects, such as for example a clientapplication 24. Processors 21 may carry out computing instructions undercontrol of an operating system 22 such as, for example, a version ofMICROSOFT WINDOWS™ operating system, APPLE macOS™ or iOS™ operatingsystems, some variety of the Linux operating system, ANDROID™ operatingsystem, or the like. In many cases, one or more shared services 23 maybe operable in system 20, and may be useful for providing commonservices to client applications 24. Services 23 may for example beWINDOWS™ services, user-space common services in a Linux environment, orany other type of common service architecture used with operating system21. Input devices 28 may be of any type suitable for receiving userinput, including for example a keyboard, touchscreen, microphone (forexample, for voice input), mouse, touchpad, trackball, or anycombination thereof. Output devices 27 may be of any type suitable forproviding output to one or more users, whether remote or local to system20, and may include for example one or more screens for visual output,speakers, printers, or any combination thereof. Memory 25 may berandom-access memory having any structure and architecture known in theart, for use by processors 21, for example to run software. Storagedevices 26 may be any magnetic, optical, mechanical, memristor, orelectrical storage device for storage of data in digital form (such asthose described above, referring to FIG. 34 ). Examples of storagedevices 26 include flash memory, magnetic hard drive, CD-ROM, and/or thelike.

In some aspects, systems may be implemented on a distributed computingnetwork, such as one having any number of clients and/or servers.Referring now to FIG. 35 , there is shown a block diagram depicting anexemplary architecture 30 for implementing at least a portion of asystem according to one aspect on a distributed computing network.According to the aspect, any number of clients 33 may be provided. Eachclient 33 may run software for implementing client-side portions of asystem; clients may comprise a system 20 such as that illustrated inFIG. 34 . In addition, any number of servers 32 may be provided forhandling requests received from one or more clients 33. Clients 33 andservers 32 may communicate with one another via one or more electronicnetworks 31, which may be in various aspects any of the Internet, a widearea network, a mobile telephony network (such as CDMA or GSM cellularnetworks), a wireless network (such as Wi-Fi, WiMAX, LTE, and so forth),or a local area network (or indeed any network topology known in theart; the aspect does not prefer any one network topology over anyother). Networks 31 may be implemented using any known networkprotocols, including for example wired and/or wireless protocols.

In addition, in some aspects, servers 32 may call external services 37when needed to obtain additional information, or to refer to additionaldata concerning a particular call. Communications with external services37 may take place, for example, via one or more networks 31. In variousaspects, external services 37 may comprise web-enabled services orfunctionality related to or installed on the hardware device itself. Forexample, in one aspect where client applications 24 are implemented on asmartphone or other electronic device, client applications 24 may obtaininformation stored in a server system 32 in the cloud or on an externalservice 37 deployed on one or more of a particular enterprise's oruser's premises.

In some aspects, clients 33 or servers 32 (or both) may make use of oneor more specialized services or appliances that may be deployed locallyor remotely across one or more networks 31. For example, one or moredatabases 34 may be used or referred to by one or more aspects. Itshould be understood by one having ordinary skill in the art thatdatabases 34 may be arranged in a wide variety of architectures andusing a wide variety of data access and manipulation means. For example,in various aspects one or more databases 34 may comprise a relationaldatabase system using a structured query language (SQL), while othersmay comprise an alternative data storage technology such as thosereferred to in the art as “NoSQL” (for example, HADOOP CASSANDRA™,GOOGLE BIGTABLE™, and so forth). In some aspects, variant databasearchitectures such as column-oriented databases, in-memory databases,clustered databases, distributed databases, or even flat file datarepositories may be used according to the aspect. It will be appreciatedby one having ordinary skill in the art that any combination of known orfuture database technologies may be used as appropriate, unless aspecific database technology or a specific arrangement of components isspecified for a particular aspect described herein. Moreover, it shouldbe appreciated that the term “database” as used herein may refer to aphysical database machine, a cluster of machines acting as a singledatabase system, or a logical database within an overall databasemanagement system. Unless a specific meaning is specified for a givenuse of the term “database”, it should be construed to mean any of thesesenses of the word, all of which are understood as a plain meaning ofthe term “database” by those having ordinary skill in the art.

Similarly, some aspects may make use of one or more security systems 36and configuration systems 35. Security and configuration management arecommon information technology (IT) and web functions, and some amount ofeach are generally associated with any IT or web systems. It should beunderstood by one having ordinary skill in the art that anyconfiguration or security subsystems known in the art now or in thefuture may be used in conjunction with aspects without limitation,unless a specific security 36 or configuration system 35 or approach isspecifically required by the description of any specific aspect.

FIG. 36 shows an exemplary overview of a computer system 40 as may beused in any of the various locations throughout the system. It isexemplary of any computer that may execute code to process data. Variousmodifications and changes may be made to computer system 40 withoutdeparting from the broader scope of the system and method disclosedherein. Central processor unit (CPU) 41 is connected to bus 42, to whichbus is also connected memory 43, nonvolatile memory 44, display 47,input/output (I/O) unit 48, and network interface card (NIC) 53. I/Ounit 48 may, typically, be connected to keyboard 49, pointing device 50,hard disk 52, and real-time clock 51. NIC 53 connects to network 54,which may be the Internet or a local network, which local network may ormay not have connections to the Internet. Also shown as part of system40 is power supply unit 45 connected, in this example, to a mainalternating current (AC) supply 46. Not shown are batteries that couldbe present, and many other devices and modifications that are well knownbut are not applicable to the specific novel functions of the currentsystem and method disclosed herein. It should be appreciated that someor all components illustrated may be combined, such as in variousintegrated applications, for example Qualcomm or Samsungsystem-on-a-chip (SOC) devices, or whenever it may be appropriate tocombine multiple capabilities or functions into a single hardware device(for instance, in mobile devices such as smartphones, video gameconsoles, in-vehicle computer systems such as navigation or multimediasystems in automobiles, or other integrated hardware devices).

In various aspects, functionality for implementing systems or methods ofvarious aspects may be distributed among any number of client and/orserver components. For example, various software modules may beimplemented for performing various functions in connection with thesystem of any particular aspect, and such modules may be variouslyimplemented to run on server and/or client components.

The skilled person will be aware of a range of possible modifications ofthe various aspects described above. Accordingly, the present inventionis defined by the claims and their equivalents.

What is claimed is:
 1. A system for identifying a file type comprising:a computing device comprising a processor, a memory, and a non-volatiledata storage device; a file-print extractor comprising a first pluralityof programming instructions stored in the memory and operable on theprocessor, wherein the first plurality of programming instructions, whenoperating on the processor, causes the computing device to: parse thecontents of a file into groups of bits or bytes; and generate afile-print for the file, the file-print comprising: an actual mean valueof the number of occurrences of each group in the file; and a standarddeviation of the actual mean value of the number of occurrences from anexpected mean value of the number of occurrences; and a file classifiercomprising a second plurality of programming instructions stored in thememory and operable on the processor, wherein the second plurality ofprogramming instructions, when operating on the processor, causes theprocessor to process the file-print through a trained machine learningclassifier to identify a file type of the file.
 2. The system of claim1, further comprising a codebook database stored on the non-volatiledata storage device, the codebook database comprising a plurality ofcodebooks which may be used to encode or decode files, wherein theidentification of the file type is used to select a codebook forencoding or decoding the file.
 3. The system of claim 2, wherein one ormore encoding or decoding parameters are configured based on theidentification of the file type.
 4. The system of claim 2, furthercomprising a file signature database stored on the non-volatile datastorage device, the file signature database comprising known filesignatures for a plurality of file types, wherein: the file is checkedfor a file signature prior to file-print extraction; if a file signatureis found, the file signature is compared to known file signatures in thefile signature database; and if the file signature matches a known filesignature, a codebook is selected based on the file signature, and thefile-print extractor and file classifier are instructed to ceaseoperations on the file.
 5. A method for identifying a file typecomprising the steps of: parsing the contents of a file into groups ofbits or bytes; generating a file-print for the file, the file-printcomprising: an actual mean value of the number of occurrences of eachgroup in the file; and a standard deviation of the actual mean value ofthe number of occurrences from an expected mean value of the number ofoccurrences; and processing the file-print through a trained machinelearning classifier to identify a file type of the file.
 6. The methodof claim 5, further comprising the steps of using the identification ofthe file type to select a codebook for encoding or decoding the filefrom a codebook database stored on the non-volatile data storage device,the codebook database comprising a plurality of codebooks which may beused to encode or decode files.
 7. The method of claim 6, furthercomprising the step of configuring one or more encoding or decodingparameters based on the identification of the file type.
 8. The methodof claim 6, further comprising the steps of: checking the file for afile signature prior to file print extraction; if a file signature isfound, comparing the file signature to known file signatures in a filesignature database stored on the non-volatile data storage device, thefile signature database comprising known file signatures for a pluralityof file types; and if the file signature matches a known file signature,selecting a codebook based on the file signature, and instructing thefile print extractor and file classifier to cease operations on thefile.